Women-focussed app Maya has been sharing sensitive data about the menstrual, emotional and sexual health of its users with Facebook, according to a report published on September 9 by a leading privacy watchdog.

Maya, owned by Delhi-based Sheroes, a social network for women, would share data with Facebook as soon as the app was installed, without even waiting for the user to read the privacy policy, according to the UK-based Privacy International.

“Even though you are asked to agree to their privacy policy, Maya starts sharing data with Facebook before you get to agree to anything,” the report, focussed on menstruation apps, said.

Facebook is in the middle of a storm of protests about its privacy policies, especially after the Cambridge Analytica episode where it was found to have exposed sensitive private data about its users without their consent.

Women users share information with Maya that they would normally not disclose to even their closest friends or family members. This would include information about the commencement of their periods, their mood, sexual activity and the use of contraceptives.

“This is an outrageous breach of trust, they have crossed the line,” said Monica, 37, who has been using the app since 2018. “The information I use the app for is very personal and private that I don’t discuss with anybody else.” Monica did not want her second name to be used for this story.

Such information can be used by advertisers to create virtual personas of users so that they can be targeted more precisely for marketing campaigns. For instance, in this scenario, it would not be too difficult for an analytics model deployed by these companies to understand the probable purchases that a user would make during a particular mood or mental state.

Sheroes told Privacy International that it had removed the core Facebook software and the analytics software responsible for leaking the data and targeting ads at women. This was after Maya, with over five million downloads on the Google Play Store, was outed as a privacy violator.

Sheroes Founder and CEO Sairee Chahal did not immediately reply to phone calls and text messages. Facebook is yet to respond to an email seeking comment.

“Although Maya’s privacy policy says that no personal data is disclosed to advertisers, it then states that users’ personal data may be used to comply with our advertisers’ wishes by displaying their advertisement to that target audience.’ They don’t specify whether this involves health-related data,” the report read.